Nivoli Edge

Nivoli Edge is a security layer that lives one step above WordPress. Attacks, floods, scanners and code changes are refused at Cloudflare's edge before a request reaches PHP, and the settings that refuse them live there too, behind an email confirmation, so a hacked WordPress cannot switch them off or install anything. The same edge serves whole HTML pages and right-sized images from the node nearest each visitor, and every number shows up inside WP admin. Free and managed, in one sentence: the plugin is free and GPL and everything that runs on your own server works without an account; the shields, the locks, the edge cache and the numbers need the managed edge, from 15 euro a month with a 14-day trial. The Edge Security layer Wordfence and Sucuri run inside the site they protect. This runs one layer up, at the edge, and the site cannot reach it. Ten shields, refused before PHP. Your server never boots PHP to turn a request away.

• Login flood limit (10 attempts per 10 minutes per address)
• Comment flood limit (5 posts per 5 minutes per address)
• Search flood limit (30 searches per 5 minutes per address)
• XML-RPC block (a cached 410)
• Login country lock (wp-login answers only the countries you list)
• wp-admin IP lock (your own addresses, with a self-lockout guard and an email rescue)
• AI-crawler block (GPTBot, ClaudeBot, CCBot and friends; search engines never affected)
• Stray-PHP lock (every .php request except the real WordPress entry points gets a 404)
• WordPress surface lock (the REST users list, ?author=N, readme.html, license.txt, the installer, debug.log)
• Security-headers pack (HSTS, nosniff, frame and referrer policies; your own values win)

Eight of them come with every managed plan; the AI-crawler block and the wp-admin IP lock from the Growth plan up. The stray-PHP and surface locks have a monitor mode that lists what blocking would have stopped before it blocks anything. Three locks, nothing inside the site can turn off. A takeover of your WordPress admin owns every plugin's settings page. Ours refuses to act on WordPress's say-so.

• Change lock: any change that weakens protection waits for a click on a link mailed to the license holder; the link applies exactly that change, once.
• Install lock: plugin and theme installs, uploads, updates, deletes and the file editors are refused site-wide until a 15-minute window is opened the same way. Automatic updates and WP-CLI run on the server and are never affected.
• Origin lock: the edge stamps a per-site secret on every request it forwards and the plugin refuses code changes that arrive without it, so knowing the server's address is no longer a way around the locks. A self-test reports whether the server enforces it.

Evidence: who did what, from where.

• Refused installs named by plugin, and every refused attempt in your inbox as it happens.
• A lock activity log with time and address for every unlock request, clicked link, confirmation and lock change.
• An attack-surface strip per fortnight, a monthly report by email, and for agencies a posture matrix across every site.

Underneath all of it, Cloudflare's managed WAF rulesets, including the WordPress rule set, run in front of every managed site. Pages served from the edge Full-page HTML caching with surgical purge: only the pages featuring a changed post refresh, never the whole cache.

• Surrogate-Key / Cache-Tag headers on every cacheable page; purges go to Nivoli, Fastly, Cloudflare Enterprise or your own webhook.
• Logged-in visitors, carts and checkout always bypass.
• Stylesheets, scripts and fonts from the edge too, on versioned addresses, so no browser or CDN node holds a stale file after a purge.
• Origin shield: if your server goes down, the edge keeps serving the last good copy of every cached page for up to 7 days and emails you when it engages and when the origin recovers.

Images served from the edge URLs rewrite through Cloudflare Image Resizing into right-sized WebP/AVIF variants on the fly. No uploads, no duplicate copies, no migration, no theme changes.

• Per-size presets, one-click Size mapping from your theme's registered sizes, a catch-all for everything else.
• Broken, heavy and fake images found from real traffic, with where each is used and one-click fixes; heavy originals shrink through Tinify.

The numbers, inside WP admin

• What the edge answered and what it refused, by window, with the most-requested and most-missed URLs.
• Dead URLs on a Recent 404s page with one-click redirect or block; a Search Console 404 export imported, matched to your own pages and turned into redirect and block rules family by family; All rules: one ordered list of every edge rule with per-rule counts and reordering.
• Audience without a tracking script: humans versus bots, countries, referrers, devices, served-from-cache speed.
• Static assets: edge hit rate per file type and which files still travel on plain addresses.
• A monthly report by email, white-label copies for clients on Business and up.

Free versus managed Free, on your own infrastructure, no account: image URL rewriting through your own Cloudflare zone (native WP filters, srcset, Gutenberg, WooCommerce, the_content and full-page scan), image rules and size mapping, page-cache tag headers with surgical purge to Fastly, Cloudflare Enterprise or your webhook, prewarm on save, coverage audit with a weekly regression email, fake-image detection and repair, purge-failure alerts, a weekly header self-test, a printable client report, the debug overlay, and WP-CLI. Managed, with a Nivoli API key: everything in The Edge Security layer above, the managed page cache and image CDN (no Cloudflare account, plan or DNS work), origin shield, URL rules and the 404 inbox, per-path cache duration, the query-param manager, cache protection, dynamic-content safety for WooCommerce, edge insights and the monthly report, custom image hostname and watermarking, and for agencies a fleet console with one key across sites. Requirements

• Free: a Cloudflare zone with Image Resizing enabled for the image half (Pro+ plan or per-1000 pricing); a tag-aware edge (Fastly / CF Enterprise / your webhook) for the page-cache half. If Image Resizing isn't enabled the rewritten URLs 404; the Tools tab has a one-click probe to verify.
• Managed: none of the above; the managed edge provides both. Just an API key from your Nivoli account.

Recent releases are listed below. The full history for every version is in CHANGELOG.md, which ships with the plugin, and on the GitHub releases page. 1.72.5 When your own Cloudflare zone proxies the domain, Cloudflare holds the certificate until the site's record points at the edge. The check now recognises that answer and unlocks the routing CNAME alongside the validation records, with a callout that says why. 1.72.4 Settings: the pane that puts the site behind the edge is called Managed edge, in the rail and on the card, instead of Page cache. 1.72.3 The routing CNAME stays hidden until the certificate is issued, so it cannot be added too early. On Cloudflare DNS an amber callout says to switch every CNAME to DNS only (proxied, the site never reaches the edge and Cloudflare answers error 1014), and every CNAME card wears a DNS-only pill. 1.72.2 Copy on a DNS record's name copies what the DNS host wants typed: _acme-challenge, _cf-custom-hostname, or @ for the domain itself. The full name stays readable next to it. 1.72.1 The DNS records that put a site behind the edge come as two phases, the same as the guided page: prove ownership and get the certificate first (an ownership TXT and the permanent certificate-delegation CNAME; live traffic untouched), then route traffic (the site's CNAME, unlocked once the certificate is active). One record per card, Copy on name and value, the certificate state remembered between checks. 1.72.0 After the key is activated, an onboarding overview on the account pane and the Dashboard walks the six steps to a site live behind the edge: key, images (test, then switch), pages behind the edge (one click, then the two DNS records inline with copy buttons and a check), shields, locks, the report. Each step shows its state and its button; the card steps aside once the site is live with the locks on. The activation notice is one sentence. 1.71.1 The Security check lives under Tools for every install, Never-loading images under Images. A free install's Managed Edge tab shows Your account only until the site is connected. The own-zone column on the Dashboard is a checked list; each security finding separates what the managed edge does from what to do on the server. 1.71.0 Two free tools. Security check: what this WordPress exposes (XML-RPC, readable usernames, the code editors, missing security headers, version disclosure, readme.html, debug.log, directory listing, a user named admin, HTTPS), five of them fixable from the pane with one click, every finding paired with what the managed edge does about it before PHP. Heaviest uploads: the largest image originals on disk with a one-click Tinify shrink. 1.70.6 The client report is a managed feature now (it is built on edge numbers) and leaves the Tools rail on free installs. The free tools card leads with surgical cache purges for your own CDN and says what they do. 1.70.5 The coverage audit on an install with no image pipeline configured shows a proper empty state with the way forward instead of a Run button that fails with a yellow warning; the fresh Dashboard's tools card no longer offers it. 1.70.4 Free installs get a Tools you can use now card on the Dashboard: never-loading images (posts referencing files that no longer exist), fake images, the coverage audit, size mapping, page-cache purging and the client report, each one click away. They were all there, spread over three tabs. 1.70.3 The own-zone path on the fresh-install Dashboard lists what the free plugin does on your own infrastructure (image rewriting, rules and size mapping, page-cache purging, prewarm, audits, fake-image repair, alerts, client report, WP-CLI) instead of only what it lacks. 1.70.2 A fresh install now opens on one decision: put the site behind the managed edge (three steps: trial, key, two DNS records) or use your own Cloudflare zone for images only. The account pane connects in the same three steps on one card, and the features list is a full-width tile grid. 1.70.1 The free install's Managed Edge pane and the Dashboard checklist now describe what the managed edge is (a security layer above WordPress: shields before PHP, locks a takeover cannot undo, pages and images from the edge, numbers measured there) instead of pitching an image CDN. 1.70.0 Query params: the Dynamic card has an Add a dynamic param field. A filter that exists but has had no traffic yet could not be kept dynamic before, because the only button for it sat on a row in the collapsed list, and a row needs traffic. Type the name, Keep dynamic, done; the edge picks it up within a minute.